topic Re: Rekey causes VPN tunnel to stop sending network traffic in VM-Series in the Public Cloud

Rekey causes VPN tunnel to stop sending network traffic

JoschkaKruse — Fri, 20 Aug 2021 10:33:45 GMT

Hello everybody, I'm having a weird issue with VPNs between a Palo Alto Cloud Firewall (PanOS9.1.3h) and Cisco Meraki Z3.All VPN Tunnels are established propely, but after a random period of time during the rekey step, a tunnel stays online, but network traffic can't be send anymore. We are currently having 5 of these connections with the same issues.

I was able to capture a log, but I'm not able to troubleshoot it. Did some anonymization, see link attached. LOG

On the Meraki site/log, you can see the there are two steps happening repeatedly on a working tunnel.

inbound CHILD_SA

outbound CHILD_SA

At the time the error occurs, the outbound step is missing.

Any ideas?

Here are the tunnel settings IKEv2

On Palo side

IPSec Crypto profile

IPSec Protocol ESP

DH group 2

LT 1h

Encryption aes-256-gcm/cbc

Authentication

sha256

IKW Crypto profile

DH Group

group2

Encryption

aes-256-cbc

Authentication

sha 256

Key LT 8h

IKEv2 Authentication Multiple 5

On Meraki side

Phase1

Encryption

AES 256

Authentication

SHA256

Pseudo-random Function

Defaults to Authentication

Diffie-Hellman group

Lifetime (sec)

28800

Phase2

Encryption

AES 256

Authentication

SHA256

PFS group

Liftime (sec)

3600

Palo Alto IKE GW Options

Passive mode Enabled

NAT-T Enabled

Advanced Option

Strict Cookie Validation turned off

Liveness Check

Interval (sec) 5

Re: Rekey causes VPN tunnel to stop sending network traffic

JakeHarris — Wed, 08 Nov 2023 14:11:25 GMT

Thought I'd reach out to see if you resolved this issue. We are encountering something similar between a Palo VM500 running 10.2.6 and a Juniper SRX. It appears on soft ipsec rekey that the Palo renews the SA and the Palo continues to use it, but the Juniper also creates a new SA (which the Palo sees and accepts) the Juniper uses this ipsec SA. Hence dropping network traffic. Would appreciate any thoughts you have.

Re: Rekey causes VPN tunnel to stop sending network traffic

JoschkaKruse — Wed, 15 Nov 2023 12:11:01 GMT

Hi Jake,

we ended up applying the latest firmware to both sides which stabilized the traffic. After updating we got rid off the hanging tunnels.